I've been searching google and I'm about to start surfing through the code, but we all know how useless searching through drupal code is.

People are running into this problem everywhere, including on my website today. So I figured it was worthy of stackexchange.

Basically, I run into this error when trying to send the contact form from my website. Others have run into it with a variety of forms.

I want to know what we're running into that is causing this error.

  • drupalcontrib.org/api/drupal/drupal--includes--form.inc/… Here's the code for this form validation. It doesn't look like anything but the token is being validated by drupal. which makes sense in terms of, "what would they look for?" So why is this token not validating? I've read a few other websites about this error, they are all suggesting that the error may be due to the login cookie. Sure enough, let the website site for a while to expire and refresh the session and this error will go away. Commented Jul 6, 2011 at 17:02

1 Answer 1


The form token associated to forms created with the form API is a value that is used to verify the data are submitted from a user who filled a module form, and not forged data.

The drupal_valid_token() function that validates the token is validating it using the user session; this means that, if the user session used when the data are being submitted is different from the session used when the form was created, the validation of the token fails. This could happen also when a module calls session_destroy().

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.